Google accused of spying on students in FTC privacy complaint

Daily News Article — Posted on December 7, 2015

(by Alistair Barr and Elizabeth Dwoskin, The Wall Street Journal) – A digital rights watchdog asked the Federal Trade Commission (FTC) on Tuesday to investigate Google’s popular education service, alleging that it violates the company’s pledge to restrict its use of student data.

The Electronic Frontier Foundation (EFF), a non-profit privacy organization, said in a complaint to the Federal Trade Commission that the service known as Google Apps for Education violates a pledge that Google signed in January. The legally binding Student Privacy Pledge, signed by more than 200 other companies including Apple Inc. and Microsoft is a vow to collect, store or use student data only for educational purposes.

The complaint by the EFF, which in the past has sided with Google on other issues, focuses on the so-called sync feature of Google’s Chrome Web browser that stores bookmarks, passwords, and browsing and search history. It alleges that sync helps Google use students’ browsing history and other data for uses beyond education.

In response to the EFF’s concerns, Google said it agreed to change the sync settings on Chromebooks sold to schools. Under the new settings, data entered or generated by students while using Google Apps for Education would not be used outside of that context.

“We are confident that these tools comply* with both the law and our promises, including the Student Privacy Pledge,” a Google spokesman wrote in an email. He declined to comment further. [*comply: to do what you have been asked or ordered to do]

An FTC spokesman said the regulator had received the complaint but declined to comment further.

However , the EFF said in an interview that the altered sync settings didn’t go far enough. Google continues to collect personal information when students are logged into their Google Apps for Education accounts and use non-educational Google services. For instance, Google collects online search terms that logged-in students enter whether or not the searches relate to schoolwork, the EFF said.

The group asked the FTC to require Google to destroy all student data it has collected and used in violation of the Student Privacy Pledge and to prevent the company from collecting such data in the future.

“The best way for Google to comply would be to simply not collect any data on the activities of logged-in Google [Apps for] Education users,” said Nate Cardozo, an EFF attorney who helped write the complaint.

Google previously has been tripped up by similar pledges, which are legally binding in the U.S. In 2012, it paid $22.5 million to settle an FTC complaint that it failed to live up to an advertising industry pledge by misrepresenting the way it tracked Web users.

Jules Polonetsky, co-chair of the Future of Privacy Forum, which created the Student Privacy Pledge, said Google was not violating the document because it used aggregated and anonymized data.

“Anonymous information uses are not covered by the pledge or any other laws around student data,” he added. Google is among 120 companies that support the FPF, a privacy think tank.

The EFF argued that aggregating and anonymizing students’ browsing history does not change the private nature of the data or the fact that it is associated with identifiable student accounts at the time it is collected.

The EFF’s complaint comes on the heels of wider controversy around student privacy in the fast-growing $8.4 billion education tech industry. Over the last year, 15 states have passed laws protecting the privacy of student data, including student email addresses and browsing behavior…. A Student Privacy Bill of Rights is pending in Congress.

Copyright 2015 Dow Jones & Company, Inc. All Rights Reserved. Reprinted here for educational purposes only. May not be reproduced on other websites without permission from The Wall Street Journal. Visit the website at wsj .com.

Questions

1. a) What is the EFF? What is it’s purpose/goal/mission?
b) What is the Student Privacy Pledge?

2. What is the role of the FTC?

3. a) What did the EFF initially ask the FTC to do?
b) Why did the EFF make this request? Be specific.

4. a) How did Google respond to the EFF’s allegation?
b) What do you think this response shows about the EFF’s allegation? (unfounded? legitimate?) Explain your answer.

5. a) Why isn’t the EFF satisfied with Google changing the sync settings? Be specific.
b) What did they ask the FTC to do?

6. a) The Future of Privacy Forum, which created the Student Privacy Pledge, said Google was not violating the Student Privacy Pledge because it used aggregated and anonymized data. “Anonymous information uses are not covered by the pledge or any other laws around student data,” Jules Polonetsky, co-chair of the Future of Privacy Forum said. What motive might the FPF have for not opposing Google?
b) How did the EFF counter the FPF’s assertion?

7. a) Define aggregated and anonymized.
b) Why do you think people would be concerned even if Google uses aggregated and anonymized data?

8. a) Would you oppose Google gathering this information on you?
b) As a student, do you trust Google when they say they use aggregated and anonymized data? Explain your answer.
c) Ask a parent if they are concerned about your privacy online. Discuss your answers.

OPTIONAL: Read the following comments from readers to the WSJ article. With which do you agree/disagree?

GaryDMN wrote: "It's Google's business model. They do not sell computers or software, they give users access to their open source software for the right to track the user. You can't get a Google account without agreeing to be tracked. That's where Google gets it's revenue, billions a month from selling ads, based on their tracking. If schools don't like it, they can get the open source software free, but would need to support it. People BELIEVE Google provides FREE service, but there is a string attached, tracking."

JonD wrote: "Gary, as with all things in life, too much of one thing, is good for nothing. This is not you or me deciding to go online despite all the other choices and using Google to search, in which case, we elect to be tracked (I guess). This is Google basically scamming its way into schools because they want to leave no stones unturned in their quest to make sure they get as many people as possible into their trap, while being able to track all aspect of their lives. So your 7 year old is being tracked at school, at home, on his Android phone and Google never gets rid of that data (which raises a why in and of itself). Is that right? Long and short, they did agree not to track kids and sure enough, just like they found a sneaky way to spy on iPhone users b4 Apple caught on, they know they always have a workaround against those trying to thwart their evil plans. I feel sorry for those using Nest products and if it makes it out of the lab, can't wait for their diabetes monitoring contacts. Go expose all your health and other issues to an evil information marketing company. Makes sense."

Webster wrote: "This is not news. Everyone in Edtech has known about this for years. People and vendors (like Microsoft) raised this alarm again and again but the answer from the schools (and from the parents) was "it's free", "everyone is doing it" and/or "they're Google. They'll fix it." Schools are extremely protective of their students and demand incredible privacy and security from any vendors the pay. However, if it is free, these requirements are instantly overlooked. Parents sending their kids to any school should ask them for their privacy commitment. How much is Google expecting to earn off one student over a lifetime? They have a number and it is certainly more than the few dollars that it would cost a school to buy a private service."

Background

The Electronic Frontier Foundation (EFF):

The Electronic Frontier Foundation is a nonprofit organization defending civil liberties in the digital world.

The Federal Trade Commission (FTC) is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act.

The first of the FTC’s 3 stated goals is: To protect Consumers: Prevent fraud, deception, and unfair business practices in the marketplace.

Its mission is to prevent business practices that are anticompetitive or deceptive or unfair to consumers; to enhance informed consumer choice and public understanding of the competitive process; and to accomplish this without unduly burdening legitimate business activity. (from ftc.gov)

Read the Student Privacy Pledge from the Future of Privacy Forum (FPF) and The Software & Information Industry Association (SIIA).